Event ID 23 — Channel Initialization

Updated: August 5, 2011

Applies To: Windows Server 2008 R2

yellow

Event logs are normally initialized when the Event Log service starts. This initialization can also happen during installation of a component that creates a new log. When the initialization fails, the log is not available to receive events and the diagnostic and troubleshooting capabilities of administrators, support personnel, developers, and automated utilities can be compromised.

The application-defined logs are specific to the event provider that created them and will only affect events published by that provider. The operations that remain for the Event Log service and all other event providers are not affected when there is a problem with one of the event logs being initialized.

Event Details

Product: Windows Operating System
ID: 23
Source: Microsoft-Windows-Eventlog
Version: 6.1
Symbolic Name: INIT_CHANNEL_LOGGING
Message: The event logging service encountered an error (res=%1) while initializing logging resources for channel %2.

Diagnose

Event 23 indicates that the Event Log service had a problem opening an event log file. Another event will be found in the log prior to event 23 that can help diagnose the problem. The problem is usually a corrupt log, a bad file path, or a log with an incorrect version. In each case, the Event Log service will attempt to open a different file. Even if the service succeeds, the administrator should repair the problem. To repair the problem, use the following procedure:

1. Repair the hard disk if the previous event indicates a corrupt log.

2. Open the log file with the correct version if the previous event indicates that the file version is incorrect.

3. Correct the path to the log file if the previous event indicates that the path is incorrect.

Resolve

To resolve this issue, use the resolution that corresponds to the cause you identified in the Diagnose section. After performing the resolution, see the Verify section to confirm that the feature is operating properly

Cause

Resolution

Incorrect Shutdown or Bad Drive

Shutdown the computer properly or repair the hard disk

Open the renamed log file

Open the renamed log file

Bad Log File Path

Reconfigure the location to the log file

Shutdown the computer properly or repair the hard disk

The most likely reason for a corrupt event log is that the computer was incorrectly shut down. The remedy for this is to always shut down the system correctly and to have backup power to avoid having the power shut off from the computer while the computer is turned on.

Another cause for a corrupt event log file is when a problem occurs with the hard disk drive that contains the event log. To resolve this problem, repair or replace the hard disk drive if required.

Open the renamed log file

The log file associated with the channel has version that is too new or too old for the Event Log to use correctly. To fix this problem, open the renamed log file on the system where the file was created.

Reconfigure the location to the log file

To change the path to a log file, open Event Viewer, right-click on the log to update, and select Properties. Change the value of the Log path field and click Apply.

Verify

Use the Event Viewer to read the affected log on the local computer after the computer has been restarted, and verify that events 20, 23, 25, 26, or 40 did not appear in the event log after the system was restarted.

Related Management Information

Channel Initialization

Management Infrastructure

Community Additions

ADD
Show: